Thursday, December 27, 2007

Recovering data from a HP Media Vault

I had a customer bring in a drive from a HP Media Vault that had failed (or flaked out or something, we're really not sure yet). It was kind of interesting trying to find data on the drive, so I thought I'd share...

After a little Googling for "broadcom nas", "hp media vault", and a few other things, I figured out there was a reiserfs filesystem on the thing somewhere. (Note: As pointed out in the first comment to this post, there is some great technical documentation on this thing online. Rather than follow it, I chose to cheat and do this the (relatively) easy way.) Google found me this nice document describing the on-disk structure of reiserfs. That's how I figured out that I was looking for a magic string "ReIsEr2Fs" (or "ReIsErFs" for version 1, or "ReIsEr3Fs" for version 3, according to some other search results). I used hexedit to find the offset of the magic string by doing hexedit /dev/hdi, hitting tab, hitting /, then typing in ReIsEr.

In this case, the magic string was at hex location 2685A034, which means the beginning of the superblock was at 2685A000, or (decimal) 646291456 bytes. The beginning of the superblock is 64k bytes before that, so I set up a loop device there:

35 comments:

Nice work! I was the Systems Architect for that product and this topic comes up periodically. I also maintain a FAQ and Yahoo Group for the Media Vault. The superblock is unique but the file system is plain Reiserfs. I have the complete documentation for the disk layout here:

Steve, wonder if you feel like being a hero? I recently had the same thing happen to my MV2010 media vault. I am desperately trying to duplicate what you did using knoppix. I found the ReIsEr string and tried to mount it, the drive reads for along time, then it says "cant read superblock". I searched for the next instance, calculated the new offset, same message. Any ideas?

I just lost all my data from my HP MV2040. I just decided to send it to a data recovery specialist and they are also having a little difficulty retrieving the data while keeping the file directory structure intact.

Brief history: mv2040 setup in raid 1 config with two 500gb sata drives. I purchased a new 1tb internal drive for my desktop to have an additional backup to the backup.

I first tried to copy the data from the media vault to the 1tb drive on my pc, but kept receiving errors. This is when the nightmare began...........

I took it upon myself to take the mirrored drive out of the vault and connect it to my xp pro desktop to perform a ghost. Windows recognized the drive and tried to initialize it. I cancelled it and return the drive back into the vault. I guess the vault tried to rebuild the mirror or something. In any case I am now not able to access my data. I reset the vault and also reloaded the source drive with the vaults OS (nasloader)

The vault can now boot and all is well except I cannot find my 270GB's of data.

Just imagine losing your entire company's data :(

This is the boat we are in.

The data recovery team reported to me today and said they can see the data but the directory structure seems to be lost or overwritten. It is just a ton of files without their original filenames and directories. I will spend at least a year opening up all the files we had just to rename them and place them in a new directory.

I don't know if anyone is still reading this, but I have a question about upgrading my 2120... It has 500gb single drive. I do not care to save anything. I want to replace single 500gb with two 1tb drives. If I do this, how do I install the OS onto the new 1tb drive? Thanks!

I am in a REAL pickle trying to recover data on disk volume that will no longer mount and desperate to find someone/some place/ some way to pull off files from a lost or broken volume (volume 1). This is the original 300GB drive and volume. Things went bad after I went to add a new drive to Volume 1 (concatenated) and I got a some system error about insufficient memory blocks (???) to complete the task. I then removed the new drive from Volume 1 however after a restart of the NAS drive is there but Volume 1 is gone.

I can't seem to find any way to mount the original Volume 1 (ahh)

Looking for anyone who might be able to help me. I really have not training on Linux...

I am in a REAL pickle trying to recover data on disk volume that will no longer mount and desperate to find someone/some place/ some way to pull off files from a lost or broken volume (volume 1).

Things went bad after I went to add a drive to the unit (concatenated) and I got a system alert (on the MediaVault Admin screen ) about insufficient memory blocks (???) to complete the task - afterwich the original 300GB Volume 1 on System Drive would not longer mount. Yikes. Cant find it at all... and I have 300GB of family pictures on this drive (ahhh).

Can anyone suggest anything here? I really am not a computer scientist and know little about linux.

Hi Steve, I'm not sure if you're still live on this but here goes. I'm working on behalf of a friend with a mv2020 that is no longer functioning and accessible. All I'm trying to do is get his data off to another device (very important!) and then I plan to fit this unit with concrete shoes and send it off over the Tobin Bridge!

I've referenced this blog and Lee Devlin's and have a Linux host to use. Obviously, I'm unable to directly mount the secondary 500GB drive in Linux but using the automated script from Gerard Robinson I receive the following output:

woodman@snotter:~$ ./mntmv1 /dev/sdb

ReiserFS superblock found at 512006144.mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so

When I run reiserfsck on this drive it terminates immediately telling me to run reiserfsck --rebuild-sb. With the non-standard location of the superblock in this implementation of reiserfs the prospect of doing this scares me. What do you all think?

Also, I removed the primary 500GB drive and did these same steps after slotting it in my Linux host, same exact result in trying to mount or running reiserfsck. The NAS unit itself may have taken a power hit, when I power it up I don't get any LEDs such as "OK" or the network light. The power button light does come on. I can't power it off using the switch, no response. It doesn't get on the network and the 10 sec press of the reset yields no visible result. The power supply outputs the expected 5 and 12 VDC. Do you think the drives might come up in a known good NAS?

Thanks so much in advance, you guys rock and far exceed HP's ability to provide sage advice!

Hi Steve, I'm not sure if you're still live on this but here goes. I'm working on behalf of a friend with a mv2020 that is no longer functioning and accessible. All I'm trying to do is get his data off to another device (very important!) and then I plan to fit this unit with concrete shoes and send it off over the Tobin Bridge!

I've referenced this blog and Lee Devlin's and have a Linux host to use. Obviously, I'm unable to directly mount the secondary 500GB drive in Linux but using the automated script from Gerard Robinson I receive the following output:

woodman@snotter:~$ ./mntmv1 /dev/sdb

ReiserFS superblock found at 512006144.mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so

When I run reiserfsck on this drive it terminates immediately telling me to run reiserfsck --rebuild-sb. With the non-standard location of the superblock in this implementation of reiserfs the prospect of doing this scares me. What do you all think?

Also, I removed the primary 500GB drive and did these same steps after slotting it in my Linux host, same exact result in trying to mount or running reiserfsck. The NAS unit itself may have taken a power hit, when I power it up I don't get any LEDs such as "OK" or the network light. The power button light does come on. I can't power it off using the switch, no response. It doesn't get on the network and the 10 sec press of the reset yields no visible result. The power supply outputs the expected 5 and 12 VDC. Do you think the drives might come up in a known good NAS?

Thanks so much in advance, you guys rock and far exceed HP's ability to provide sage advice!

Thanks PoliticAl2008 for this!!!! so chuffed that i'm over half way to getting all my data back!!! this worked on the 1st drive in the NAS

i had to change point 5. to get it to work for me... (added 'sudo')

5. Get into hexedit for /dev/sdb* Type: sudo hexedit /dev/sdb

I have now got a real nightmare, i had a 2nd drive in my MV2010 and when i thought it was wrecked, i took out the 2nd drive and put it in a Netgear NAS, which started to 'initialise'!!! i quickly stopped it but i think it may have started to format the drive as when i look at the hex code on the drive... everything as far as i can see is 00000000.... does anyone know anything i can do in this case? not sure where to go on this now.... cheers.... N

I must say thank you as well. A customer brought in this unit, and with your help and the tool provided I was able to return over 4300 files for the customer.

Now, if I can only get the customer to make backups...

Mavrick, I'm no expert, but make sure you have support for ReiserFS installed in your Linux with that error. I used the Gerarad Robinson tool at the bottom of this page:http://k0lee.com/hpmediavault/diskformat/ to find mine. I hope this helps.

Hi, I am also getting this error:mount: wrong fs type, bad option, bad superblock on /dev/loop2, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so

p.s. When I searched for ReIsEr in HexEdit, I found, in this order:....ReIsErLB........ReIsEr2Fs.......ReIsEr2Fs...

Would anyone here that has done this successfully want to get paid for working on recovering data from my drive?I am about to send it to a data recovery center that charges between 200 - 800 (if they get the data recovered) and I'd be willing to pay up to 300 USD to get my data recovered.

Thank you for this post, it was extremely helpful. It worked "as is" for recovering a disk from an ASUS WL-700gE. The offset on the device was exactly the same. I found your post because I started out the same way you did and did a google search for "Broadcom NAS Version 1.1 MBR".

Oh my! You sure saved my day. I had a broken board on my WD Netcenter (320GB), but the disk was fine, according to the SMART info. I had no idea how to retrieve the data, until I saw this post. I love you!

All my photos, family video's, contracts, documents..... All of my "digital-live" was on my mv2010 (RAID-1) NAS Server.

HP said me this product was obsolete and they deny to help me in any way.

Following your step by step instructions and adding the notes from "PoliticAl2008"..... I have recovered all my information with an Ubuntu 10.10 "live-cd". No changes at the instructions from PoliticAl2008.

Absolutely fantastic! Worked like a charm. The motherboard on my MediaVault died. Fortunately, about a month prior, I had purchased a PC with 2TB of disk space. I had already split it into 1TB apiece for Windows and Ubuntu. So I had plenty of space on my PC hard disk to copy all the data from my MediaVault.

I'm in the process of recovering family photos, important records, movies, and music.

Thank you so much for sharing this! I can't properly communicate how important this information was.